Is it possible to support future-dated access requests in ISC

[shsakshi (SAKSHI SHARMA)]

There is a requirement that an access request should support something like a start date or future activation time.
The idea is:

• an access request is submitted now
• But the access should become active later at a scheduled time

Is this possible in ISC using workflow triggering and scheduling, or any similar approach?
If scheduling a workflow for an access request can work, could anyone please share the recommended approach or any reference documentation?

[KRM7 (Krishna Mummadi)]

There is no Start date feature only end date for Access Requests.

You can use workflow with Access Request submitted Trigger and Wait Action.

Does the start date needs to be selected by requestor or is it kinda fixed ?

[shsakshi (SAKSHI SHARMA)]

Hi @KRM7

Thank you for the suggestion.
The preferred approach is to call the API and provide the date while triggering the workflow.

While reviewing the following document: Workflow Triggers - SailPoint Identity Services Workflow Triggers - SailPoint Identity Services

There are fields such as addDate and removeDate, and it is not clear how they should be validated or used.

Also, there are references to startDate and endDate. It is not clear whether these are directly related to access activation and expiration.
Could you please help clarify:

• How addDate and removeDate are intended to be used
• whether startDate and endDate are related to access timing
• How can these values be passed while triggering the workflow through the API

If there is any example or reference for this flow, please share.

[AsGoyal (Aayush Goyal)]

Hi @shsakshi ,

For the respective access profiles, you can attach it to access request workflow. Flow can be as below:-

1. Your tenant need to have access to adaptive approvals.

2. Access request submitted trigger —> action form —> Get start date—> add variable as number of days—> pass the wait as number of days and conplete the workflow.

Ideally if I say that this will be activated after 30 days, the execution will happen for 30 days which doesn’t make a lot of sense as per my opinion .

Hope this helps

[BhanuKondi]

Hi @shsakshi ,
For any access request, we can select only end date , start date selection is not supported, so we can use a workflow which triggers whenever access request is submitted, but to use this trigger, your tenant should have adaptive approvals enabled, then only you can use the access request submitted trigger.

[utkirjonkamiljanov]

Check out this community blog post that covers a very similar pattern using workflows with access request triggers and date-based logic, might be a helpful starting point:

Mandatory Expiration Dates for Access Requests in ISC with Workflows

[Mandatory Expiration Dates for Access Requests in ISC with Workflows] Background The ability to set expiration dates for requestable items in Identity Security Cloud has been a feature for a while now. When somebody submits an access request, they can set the expiration date to automatically have that access removed when that date is reached. The automatic removal works well, but it does have the limitation that access requests cannot be configured to make expiration dates required. As such…

[SatishAtike]

Hi @shsakshi ,
we can use the access request submitted trigger in workflow and trigger it when the request is submitted and add a wait step for the delay, then process approval or reject, but for this adaptive approvals should be enabled first.